CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 341:

  You have enabled "Full Log" as a tracking option to a security rule. However, you are still not seeing any data type information.

  What is the MOST likely reason?

  A. Logging has disk space issues. Change logging storage options on the logging server or Security Management Server properties and install database.
  B. Data Awareness is not enabled.
  C. Identity Awareness is not enabled.
  D. Logs are arriving from Pre-R81 gateways.
  B. Data Awareness is not enabled.

  ---

  Explanation

  The most likely reason why you are not seeing any data type information in your logs even though you have enabled Full Log as a tracking option to a security rule is that Data Awareness is not enabled on your Security Gateway. Data Awareness is a feature that allows you to monitor and control data types that are transferred over HTTP, HTTPS, FTP, SMTP, POP3, or IMAP protocols. Data Awareness can identify over 700 data types, such as credit card numbers, social security numbers, bank account numbers, medical records, etc., and provide visibility into the data usage patterns of your users. Data Awareness can also enforce data loss prevention (DLP) policies to prevent sensitive data from leaving your network or entering your network from untrusted sources. To enable Data Awareness on your Security Gateway, you need to activate the Data Awareness Software Blade in SmartConsole and install the policy on the Security Gateway.

• Question 342:

  With MTA (Mail Transfer Agent) enabled the gateways manages SMTP traffic and holds external email with potentially malicious attachments.

  What is required in order to enable MTA (Mail Transfer Agent) functionality in the Security Gateway?

  A. Threat Cloud Intelligence
  B. Threat Prevention Software Blade Package
  C. Endpoint Total Protection
  D. Traffic on port 25
  B. Threat Prevention Software Blade Package

  ---

  Explanation

  To enable MTA (Mail Transfer Agent) functionality in the Security Gateway, the Threat Prevention Software Blade Package is required. The Threat Prevention Software Blade Package includes the Anti-Virus, Anti-Bot, and Threat Emulation blades, which can scan and hold external email with potentially malicious attachments. The MTA functionality allows the Security Gateway to act as an SMTP relay between the mail server and the Internet, and apply Threat Prevention policies to the email traffic. The other options are either not related or not sufficient to enable MTA functionality.

• Question 343:

  Fill in the blank: A ________ VPN deployment is used to provide remote users with secure access to internal corporate resources by authenticating the user through an internet browser.

  A. Clientless remote access
  B. Clientless direct access
  C. Client-based remote access
  D. Direct access
  A. Clientless remote access

  ---

  Explanation

  A clientless remote access VPN deployment is used to provide remote users with secure access to internal corporate resources by authenticating the user through an internet browser. A clientless remote access VPN does not require any software installation or configuration on the user's device. Instead, it uses a web-based portal that acts as a proxy between the user and the corporate resources. The user can access web applications and services through the portal using a standard web browser that supports SSL/TLS encryption. The portal can also provide single sign-on (SSO) capabilities for SAML-enabled applications. A clientless remote access VPN is suitable for scenarios where users need to access mainly web-based resources from unmanaged devices or devices that cannot run VPN clients.

  The other options are incorrect because: A client-based remote access VPN deployment is used to provide remote users with secure access to internal corporate resources by installing VPN client software on the user's device. A client-based remote access VPN requires software installation and configuration on the user's device. It uses IPsec or SSL/TLS protocols to create a secure tunnel between the user's device and the VPN gateway. The user can access any type of resource through the tunnel using any application that supports TCP/IP protocols. A client-based remote access VPN is suitable for scenarios where users need to access various types of resources from managed devices or devices that can run VPN clients.

  A clientless direct access deployment is not a valid term for a VPN deployment. Direct Access is a feature of Windows Server that allows remote users to securely access internal corporate resources without using a VPN connection. Direct Access uses IPv6 transition technologies and IPsec protocols to create a secure connection between the user's device and the Direct Access server. The user can access any type of resource through the connection using any application that supports TCP/IP protocols. Direct Access requires software installation and configuration on both the user's device and the Direct Access server.

  Direct Access is not a term for a VPN deployment, but a feature of Windows Server that allows remote users to securely access internal corporate resources without using a VPN connection. Direct Access uses IPv6 transition technologies and IPsec protocols to create a secure connection between the user's device and the Direct Access server. The user can access any type of resource through the connection using any application that supports TCP/IP protocols. Direct Access requires software installation and configuration on both the user's device and the Direct Access server.

• Question 344:

  Full synchronization between cluster members is handled by Firewall Kernel.

  Which port is used for this?

  A. UDP port 265
  B. TCP port 265
  C. UDP port 256
  D. TCP port 256
  D. TCP port 256

  ---

  Explanation

  Full synchronization between cluster members is handled by Firewall Kernel using TCP port 256 by default. Full synchronization occurs when a cluster member joins or rejoins the cluster and needs to receive the entire state table from another member.

  References:

  [ClusterXL Administration Guide]

• Question 345:

  UserCheck objects in the Application Control and URL Filtering rules allow the gateway to communicate with the users.

  Which action is not supported in UserCheck objects?

  A. Ask
  B. Drop
  C. Inform
  D. Reject
  D. Reject

  ---

  Explanation

  The action that is not supported in UserCheck objects is Reject. UserCheck objects in the Application Control and URL Filtering rules allow the gateway to communicate with the users and display messages or requests on their browsers. The supported actions in UserCheck objects are Ask, Inform, Block, and Continue. The Ask action prompts the user to confirm or cancel an action. The Inform action notifies the user about an event or a policy. The Block action prevents the user from accessing a resource or performing an action. The Continue action allows the user to access a resource or perform an action after

  displaying a message.

  References:

  [UserCheck]

• Question 346:

  SmartEvent does NOT use which of the following procedures to identify events:

  A. Matching a log against each event definition
  B. Create an event candidate
  C. Matching a log against local exclusions
  D. Matching a log against global exclusions
  C. Matching a log against local exclusions

  ---

  Explanation

  SmartEvent does not use matching a log against local exclusions to identify events. Local exclusions are filters that are applied to logs before they are sent to the SmartEvent server. They are used to reduce the amount of logs that are forwarded by the Security Gateways or Log Servers, and to avoid sending irrelevant or sensitive logs. Local exclusions do not affect the event detection process, which is performed by the SmartEvent Correlation Unit on the SmartEvent server.

  References:

  Check Point Security Expert R81 Course, SmartEvent Administration Guide, SK120193 - How to configure Local Log Filtering on Security Gateway /Cluster / VSX

• Question 347:

  Which features are only supported with R81.20 Gateways but not R77.

  x?

  A. Access Control policy unifies the Firewall, Application Control & URL Filtering, Data Awareness, and Mobile Access Software Blade policies.
  B. Limits the upload and download throughput for streaming media in the company to 1 Gbps.
  C. The rule base can be built of layers, each containing a set of the security rules. Layers are inspected in the order in which they are defined, allowing control over the rule base flow and which security functionalities take precedence.
  D. Time object to a rule to make the rule active only during specified times.
  C. The rule base can be built of layers, each containing a set of the security rules. Layers are inspected in the order in which they are defined, allowing control over the rule base flow and which security functionalities take precedence.

  ---

  Explanation

  The features that are only supported with R81.20 Gateways and not with R77.x are described in option

  C: "C. The rule base can be built of layers, each containing a set of the security rules. Layers are inspected in the order in which they are defined, allowing control over the rule base flow and which security functionalities take precedence." This feature, known as Rule Base Layers, allows for greater flexibility and control in organizing and prioritizing security rules within the rule base. Options A, B, and D do not specifically pertain to features introduced in R81.20 and are available in earlier versions as well.

  References:

  Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.

• Question 348:

  What SmartEvent component creates events?

  A. Consolidation Policy
  B. Correlation Unit
  C. SmartEvent Policy
  D. SmartEvent GUI
  B. Correlation Unit

  ---

  Explanation

  The SmartEvent component that creates events is the Correlation Unit, which is responsible for correlating and analyzing security events to identify patterns and potential threats. Option A, "Consolidation Policy," does not create events but is used to configure policies for event consolidation.

  Option C, "SmartEvent Policy," is not responsible for creating events but is used to configure policies related to SmartEvent.

  Option D, "SmartEvent GUI," is the graphical user interface for managing SmartEvent but does not create events itself.

  References:

  Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.

• Question 349:

  What is the biggest benefit of policy layers?

  A. To break one policy into several virtual policies.
  B. To include Threat Prevention as a sub policy for the firewall policy
  C. Policy Layers and Sub-Policies enable flexible control over the security policy
  D. They improve the performance on OSkernel version 3.0
  C. Policy Layers and Sub-Policies enable flexible control over the security policy

• Question 350:

  Fill in the blank: An identity server uses a _________ to trust a Terminal Server Identity Agent.

  A. Shared secret
  B. One-time password
  C. Certificate
  D. Token
  A. Shared secret